I have some mockup html/javascript on my desktop, I made an ajax GET call to:


and got back 200 OK with results. But I noticed that the response's accept-header was:

Access-Control-Allow-Origin: http://www.bungie.net when using a proxy (and it was null when using Firefox).

In either case, why didn't this throw an cross origin resource sharing error? The response header didn't say *, so technically this should fail because my desktop is not on the bungie.net domain. Why did it succeed?

Thanks so much!

  • 1
    How are you hosting your local code? If it's just as a direct file path into your browser, it may ignore SOP as you've not got an origin. Keep in mind that the SOP for CORS is browser-enforced, not server-enforced. – Polynomial Mar 20 '15 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.